The power of computing has grown, and continues to grow, rapidly. This increased computing power has provided users of the computing power new opportunities to use computers in new ways. Specifically, computing systems have evolved from being a large central process unit (CPU) with multiple terminals, to being multiple smaller processors interconnected with each other in a distributed processing environment. This shift in processor distribution altered the security problems involved with maintaining limited access to specified data in the processing system. When the computer system was a large CPU with many terminals, access to data was controlled through the operating system of the one CPU which allocated the resources of the CPU. This meant that controlling access to data was relatively simple through the technique of using passwords to identify the user. In a distributed processing environment however, a single processor does not have the resources to identify all users so that password identification is not practical. Moreover, there is no central control over the workstations so that security systems based on an operating system must be replicated in each workstation which is an inefficient use of the processor resources.
Data encryption is a term used for a method of preserving the privacy of data stored in a computing system or communicated over a network. For example, the Data Encryption Standard (reference 2) defines a method of encrypting data, and the IBM Information Protection System (reference 3) applies that standard to computer files. The latter product requires users to manually invoke encryption for specific files, whereas the Cryptographic File System for Unix (reference 1) automatically applies cryptography to files. In each of these products, an encryption key must be manually supplied by the user. The present invention provides a way to automate the handling of such encryption keys.
There are two basic types of data encryption methods: conventional or symmetric methods, such as DES reference 2, and public-key or asymmetric methods such as RSA reference 7. Conventional methods use the same key for both encrypting and decrypting data; public-key methods use different keys for the two operations. Conventional methods arc generally faster than public-key encryption, and are thus more appropriate for bulk data file encryption as envisaged in this invention. The principal disadvantage of conventional encryption is complexity in the management of encryption keys. The purpose of the present invention is to ameliorate this disadvantage by providing a way to manage encryption keys used for conventional encryption of data files.
Message authentication is a term used for any procedure for ". . . determining with a high level of confidence whether a string of text (plaintext or ciphertext) has been altered (accidentally or intentionally)" (reference 5, p. 100). Message authentication should not be confused with user authentication and network authentication, which are described below. Message authentication can be used to verify the integrity of the contents of data files stored in computer systems. Data files that are protected with message authentication techniques can be themselves stored in either encrypted or plaintext form.
Procedures for message authentication are described in pages 100-105 and 359-367 of reference 5. These procedures depend upon the use of a key for encrypting a message authentication check. The present invention system provides a way for automating the management of such keys.
Many data encryption and message authentication systems require users to manually provide encryption keys. These keys are required both when files are first encrypted and later when they are decrypted. Disadvantages of manual key management include the awkward and time-consuming requirement for end-users to enter encryption keys, the possibility that users may forget keys, the likelihood that users may select cryptographically weak keys, the inability to access encrypted files when the individual who knows the keys is unavailable, and the need to distribute keys to all individuals who share access to encrypted files. The system according to addresses these issues by providing a way to automatically manage encryption keys.
In recent years, the reduced cost of computing equipment has encouraged the use of large numbers of small computers. Often, these are interconnected via computer networks to form distributed systems with many interdependent functions. For a distributed system shown in FIG. 1, data files on disk 8 may be transferred over link 10 and stored on a file server 2 that is remote from the computer 4 that access the files on the file server 2 through network 6. This is an alternative to the more traditional local storage of data files on disk 12 directly connected by link 14 to the computer 16 that access the files, as shown in FIG. 2.
Note that when data files are stored on a file server 2, as in FIG. 1, the data traverses a computer network 6 that is, in many cases, shared with many other user computers. In this situation, it is generally technically easy for equipment connected to the network to read the data bytes as they are transmitted between the computer user and the file server. Encrypting the data is necessary if privacy is desired. However, encryption requires some method to coordinate the encryption keys used for communication on the network.
A file server 2, as shown in FIG. 1, is often shared by multiple user computers for two reasons: (1) to amortize the cost of the file server over many users; and (2) to permit users to share data among themselves. Typically, the file server provides access controls which permit file owners to specify which other users can share their files. For example, user A may indicate that user B may read file 1 while user C may read and write file 2.
Although file access controls are effective for limiting the access of end-users to each others' files, access controls do not ensure complete privacy of files. Typically, system administrators have the ability to override these controls for purposes such as performing file backup. Data encryption of files has the advantage that only users who have the correct encryption keys can make use of the contents of files.
File access controls imply that the file server is able to reliably and securely identify users who request access to files. Typically, users identify themselves by executing a login process that involves entering a computer userid and matching password. The mechanism For validating the userid and password, and for maintaining the connection between the user and any processes run on behalf of the user, is called user authentication. User authentication should not be confused with message authentication, as discussed above. For example, referring to FIG. 1, the userid and password may be checked against a password file in either the client computer 4 or the file server 2, or both. Note that the password must be transmitted across the network 6 if the password validation is performed within the file server 2. Hence, the password itself should be encrypted if there is a concern about network eavesdropping.
A network authentication mechanism, such as Kerberos (reference 8), keeps the password file on a authentication server 20 as shown in FIG. 3. A special protocol is used to validate a userid and password entered on a user computer 22 against the password file on the authentication server 20. The latter generates authentication data, embodied in a ticket, that identifies the user. For example, the user computer obtains from the authentication server 20 a ticket to access the file server 24. The user computer 22 forwards this ticket to the file server 24 whenever the user wants to accesses a file. The file server 24 relies on the contents of the ticket to identify the user. The files are retrieved over link 28 from disk 30 to file server 24.
Kerberos uses cryptographic techniques to avoid sending the password on the network 26, to protect the contents of tickets, and to allow the file server 24 to be certain that the tickets are both valid and issued by the authentication server 20. Advantages of this scheme include (1) the password is kept in one place rather than in (potentially) multiple user computers or file servers 24; (2) the password is not transmitted over the computer network 26; (3) each ticket contains a dynamically-generated encryption key shared by the user computer 22 and the file server 24.
Other mechanisms can be used for network authentication. For example, KryptoKnight (reference 6), uses somewhat different protocols to achieve functions similar to Kerberos. As another example, a network authentication mechanism could be based upon public-key cryptography.
The previous discussion is presented in terms of file service, but applies equally to database service (both local to a user computer or distributed to a database server). The same mechanisms for user authentication and data access control are used with database systems. As with file services, complete data privacy can be achieved in database systems only by applying data encryption techniques. The latter imply the need to manage data encryption keys.